((Image:\\powershell.exe OR Image:\\pwsh.exe) (CommandLine:\ \-e\ * OR CommandLine:\ \-en\ * OR CommandLine:\ \-enc\ * OR CommandLine:\ \-enco* OR CommandLine:\ \-ec\ *)) (-(CommandLine:\ \-Encoding\ * OR (ParentImage:C\:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\* OR ParentImage:\\gc_worker.exe*)))